How can attacker bypass this dom xss filter? [closed]

Question

I'm trying to solve an dom xss challenge where filter used is :

var anchor = window.location.hash.substring(1);
if (window.location.href.match(/(script|javascript|src|onerror|%|<|>)/g)) {
        alert('xss detected');

After filter is bypassed location hash is written on page through document.write. I can't think of working solution since % is in regex , so no hex and <> is also in filter. Any hint or suggestion in appreciated.

Answer 1

There's more than just normal Hex encoding! There's also Hex Entities.

<script>alert("xss")</script>

Is equal to:

<script>alert("xss")</script>

There's also decimal value: &#60&#115&#99&#114&#105&#112&#116&#62&#97&#108&#101&#114&#116&#40&#34&#120&#115&#115&#34&#41&#60&#47&#115&#99&#114&#105&#112&#116&#62

Hopefully this'll aid you.